Page 1 of 1

Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-ons

PostPosted: Wed Nov 23, 2016 12:39 pm
by anon42
I just upgraded NoScript 2.9.5.1 from NoScript 2.9.0.14 and discovered that the (Mac OS X 10.6.7) Firefox (48.0.2) Addons option to "Get add-ons" hangs Firefox. It's supposed to bring up a page that starts with "Personalize your Firefox". The only way out of this is to force quit Firefox and relaunch.

After a bit of experimentation I discovered that I could get "Get add-ons" to work if I set NoScript's XSS advanced option check box for "Sanitize cross-site suspicious requests" off. Previously it was on and that still works with 2.9.0.14.

There could be a possibility that 2.9.5.1 is interacting with one of my other 38 addons since I cannot reproduce the problem with a clean profile. However, that interaction would have to have been introduced by 2.9.5.1 since using 2.9.0.14 in the same full profile does not have the Get add-ons problem when the only addon changed/updated is NoScript. So I have to blame NoScript for introducing the possible interaction.

At the moment I am getting around the problem by keeping the Sanitize option off. But I prefer to keep it on as it has always been in the past. Of course I could just elect to keep it on. It's not like I ever use that "Get add-ons" very much! But if the page Get add-ons accesses to produce this problem is similar to some other page I might happen to visit in the future that would not be good.

I hope the info I provided is sufficient to address this problem.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Wed Nov 23, 2016 4:30 pm
by barbaz
When this issue occurs, do you see "[NoScript XSS]" or InjectionChecker message(s) in the Browser Console (Cmd-Shift-J)?

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Wed Nov 23, 2016 8:11 pm
by anon42
Problem is that when this occurs FF hangs so I cannot look at the console. And if I keep the console displayed prior to clicking on get addons the hang occurs before anything is written to it.

I stumbled into this problem late last night and my memory is a bit fuzzy on what led me to XSS in the first place but as I recall, when things like this happen (i.e., clean profile works, full profile doesn't), I experiment with a copy of my full profile and start eliminating addons to check for interactions. I believe I got it to a point where I saw "XSS" in NoScript's popup menu when it didn't hang but Get Addon's did not bring up the page either. As I am typing this (next morning) I guess I will have to repeat that experiment to try to reproduce it and look at the console when/if I get to the point where I might see anything.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 1:18 am
by Thrawn
The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 1:33 am
by barbaz
I can't reproduce this problem in Firefox 48.0.2...on Linux.

Please create a clean profile from scratch. Install only NoScript latest development build, leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 5:03 am
by anon42
Thrawn wrote:The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?

I did finally reproduce the problem in a clean profile after going through the elimination process trying to find out which of my other addons might be interacting with NoScript in a copy of my full profile. It appears to be Custom Buttons (CB).

I figured that maybe one of my many custom buttons might be the culprit since I couldn't reproduce the problem in a clean profile with only NoScript and CB because in that case there are no custom buttons defined. So I took my CB data base (the custombuttons directory within my full profile) and moved it into the clean profile. Thus I had a clean profile with only NoScript 2.9.5.1 and CB installed along with my full collection of custom buttons. Thus at this point all the buttons can be seen in the customize window because none of them have been placed on tool bars in the clean profile setup.

The "hang" reproduced in the clean profile with just NoScript 2.9.5.1 and CB and my full set of custom buttons. It is strange since none of the custom buttons are actually installed on tool bars so I would think none of their code should be executed. At any rate I went on the "hunt" deleting my custom buttons in this clean profile. The "hang" continued to reproduce but eventually I saw the Get Addons appear after a long delay.

On a hunch I deleted more of the buttons (remember none of them are actually active -- you can only see them in customize) and sure enough the Get Addons page started to appear when I clicked it with a shorter and shorter delay as I deleted more and more buttons. Just to check out that the "hang" was only a long delay I put back my full set of custom buttons (simply copy the custombuttons directory again from my full profile back into the clean profile I'm testing with). With the full set of my custom buttons I clicked the Get Addons and just left it alone. I didn't time it but I think the "hang" took over an hour to come up on my 3.33 GHz machine. But the point is the Get Addons page did show up.

It looks to me that the length of the hang may be exponentially long as a function of the number of custom buttons I have defined. I really don't understand why an otherwise passive data base of button definitions (some of which are bookmarklets) should have any affect on NoScript, let alone its XSS sanitize option. Weird.

barbaz wrote:I can't reproduce this problem in Firefox 48.0.2...on Linux.

Please create a clean profile from scratch. Install only NoScript latest development build, leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?

See above for most of this. As for using the latest development build I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO? If not of course I would expect it to work because I said 2.9.0.14 worked prior to updating to 2.9.5.1. If that dev build is diffferent and you simply haven't updated its version number yet, then great, whatever you did fixes the problem.

Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 2:25 pm
by barbaz
Nice troubleshooting. Image

anon42 wrote:As for using the latest development build I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO?

The latest dev build, 2.9.5.1rc1, is currently same as 2.9.5.1 stable. It's just standard troubleshooting to try the dev build.

anon42 wrote:Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.

Well, you should send it to Giorgio Maone somehow. I've no idea how he'd prefer it to be sent to him. I suggest you ask him about this in PM if he doesn't reply here.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 5:46 pm
by anon42
barbaz wrote:The latest dev build, 2.9.5.1rc1, is currently same as 2.9.5.1 stable. It's just standard troubleshooting to try the dev build.

Oops. Didn't read far enough down that page. If it's the same as the released 2.9.5.1 I would expect it to "hang" too and of course it does (just tried it to make it official).
Well, you should send it to Giorgio Maone somehow. I've no idea how he'd prefer it to be sent to him. I suggest you ask him about this in PM if he doesn't reply here.

I'll wait and see if he replies here first.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 7:41 pm
by Giorgio Maone
Please check latest development build 2.9.5.2rc1, then if the problem persists send me your NoScript Options>Export file by email, thank you.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Nov 24, 2016 10:56 pm
by anon42
Just tried it. No change. Still "hangs".

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Tue Nov 29, 2016 6:32 am
by anon42
Giorgio Maone: Did you get a chance to look into my problem? I just posted in the custom buttons forum to see if they have any insight into this problem.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Tue Nov 29, 2016 9:06 am
by Giorgio Maone
Did you already check it persists on 2.9.5.2?

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Wed Nov 30, 2016 3:49 am
by anon42
Of course. Problem persists.

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

PostPosted: Thu Mar 09, 2017 6:52 pm
by fandeath
@anon42
hello, I had similar problem and I solved it now.
I hope this may help you.
viewtopic.php?f=7&t=22625&p=87069#p87069